By Hridoy Ahmed | Last updated: October 2026 | 7 min read
Short answer: To secure a WordPress site, keep WordPress, plugins and themes updated, use strong passwords with two-factor login, limit user roles, take regular off-site backups, use a firewall and remove software you do not use. No checklist makes a site unhackable, but these steps close the most common doors.
In this guide: 12 checks | Common mistakes | FAQ
Most WordPress hacks use known weaknesses, often in outdated or abandoned plugins. This checklist focuses on prevention only.
If you want a professional to set this up, see my WordPress security service.
The checklist
- Update everything. WordPress core, plugins and themes. Turn on safe automatic updates where it makes sense.
- Remove what you do not use. Delete unused plugins and themes, not just deactivate them.
- Avoid nulled software. Pirated themes and plugins often carry malware.
- Use strong, unique passwords. Use a password manager.
- Turn on two-factor authentication for admin accounts.
- Limit login attempts and protect the login page.
- Use least-privilege roles. Give people only the access they need.
- Do not use “admin” as a username.
- Back up regularly and off-site. Test a restore at least once.
- Use a firewall. A web application firewall blocks common attacks.
- Use HTTPS and keep your hosting and PHP version up to date.
- Monitor. Watch for new admin users, file changes and uptime. Disable the built-in file editor if you do not need it.
If something already looks wrong, read how to know if your WordPress site is hacked.
Common mistakes
- Keeping old plugins “just in case”
- Sharing one admin login between people
- Keeping backups only on the same server
- Installing a security plugin and then ignoring updates
- Relying on hosting security alone
FAQ
Do I need a security plugin?
It can help with firewall, scanning and login protection. Choose one and keep it updated. It does not replace updates and backups.
How often should I back up?
It depends on how often your site changes. A busy shop needs more frequent backups than a brochure site.
Is WordPress insecure?
WordPress core is actively maintained. Most problems come from outdated plugins, weak passwords and poor hosting practices.
Want it done for you? I set up hardening, firewall and monitoring. See my WordPress security and malware removal service.
About the author: Hridoy Ahmed is an SEO specialist and WordPress security expert based in Dhaka, Bangladesh. He has 8+ years of experience and works with clients worldwide.
Free tools
- WordPress Security Checklist tool: tick what you already do and get a to-do list of what is missing
- Website Security Headers Checker: see which security headers your site sends